DRAFT_Security_PWS_20180728.docx

PROGRAM SECURITY SUPPORT SERVICES

PERFORMANCE WORK STATEMENT (PWS)

27 July 2018

1.0 PURPOSE

The F-35 Joint Program Office (F-35 JPO) requires program security support services to support its critical mission of developing the next generation strike fighter aircraft. The program security support disciplines consist of Program Management, Security Operations, Program Protection, Foreign Disclosure, International Security, and Special Security Studies. The program security support services encompass the management and control of controlled unclassified information (CUI), collateral/general service (GENSER) information, Special Access Program (SAP) information, North Atlantic Treaty Organization (NATO) information, Critical Nuclear Weapons Design Information (CNWDI) and Sensitive Compartmented Information (SCI). This is an Indefinite Delivery/Indefinite Quantity contract which sets forth the conditions and clauses under which future acquisitions between the parties shall be governed. This contract will be used as a means of providing security services to the F-35 JPO.

The F-35 Lightning II Program (previously known as the Joint Strike Fighter Program) is a joint, multi-national program and is the Department of Defense's (DoD) focal point for defining affordable next generation strike aircraft weapon systems among the United States (U.S.) Air Force (USAF), U.S. Navy (USN), U.S. Marine Corps (USMC), and U.S. allies composed of eight (8) cooperative international partners: the United Kingdom, Italy, Netherlands, Turkey, Canada, Australia, Denmark, and Norway. The program’s objective is to develop and deploy the F-35 Air System (AS), a three (3) variant family of highly common and affordable 5th Generation strike fighter aircraft that meets the operational needs of the USAF, USN, USMC, and cooperative partner international services. Additional production of the F-35 is made through Foreign Military Sales (FMS). The F-35 security team has a mature Program Protection Plan (PPP), robust policies and procedures and established SAP facilities throughout the world. However, requirements continue to evolve as the program matures and the F-35 security team is responsible for ensuring that any new security challenges are appropriately identified and safeguarded in accordance with (IAW) Department of Defense regulations and specifications.

2.0 APPLICABLE DOCUMENTS

Applicable documents include, but are not limited to, the following:

2.1.1 DoD 5220.22-M, National Industrial Security Program Operating Manual, (NISPOM) 28 Feb 2006

2.1.3 DoDM 5200.01 DoD Information Security Program Volumes 1- 4 24 Feb 2012

2.1.4 DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) Sep 1998

2.1.5 DoDD 5230.24 Distribution Statements on Technical Documents, Change 1, Effective 28 Apr 2016

2.1.6 DoDD 5205.07 Special Access Program Policy (latest version)2.1.7 DoDI 5205.11 Management, Administration, and Oversight of DoD Special Access Programs (SAPs) (latest version)

2.1.8 DoDM 5205.07 DoD Special Access Program, volumes 1-4 (latest version)

2.1.9 Air Force Policy Directive (AFPD) 16-7, Special Access Programs

2.1.10 Air Force Instruction (AFI) 16-701, Management, Administration, and Oversight of Special Access Programs (latest version)

2.1.11 SAF/AAZ Memorandum, Implementing DoD Manual 5205.07, V4 SAP Manual: Marking, United States Air Force Security Marking Guide for Special Access Programs (latest version)

2.1.12 SAF/AAZ Memorandum, Implementation of DoDM 5205.07, DoD Special Access Programs (SAP) Security Manual, volumes 1-4 (latest version)

2.1.13 SAF/AAZ Memorandum, Mandatory Use Policy for Air Force Special Access Program (SAP) Assessment and Authorization Too/(AFSAAT), latest version

3.0 REQUIREMENTS

3.1 General Requirements

The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of collateral secret. The current operating environment required for this contract includes the most recent suite of Microsoft Office and Adobe business products. Other specialized operating environment requirements may be required at the Task Order level.

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the F-35 JPO. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the F-35 JPO during working hours whether at Contractor work site or on travel.

3.2 Place of Performance

The primary place of performance is within Government facilities at the F-35 JPO in Crystal City, Arlington, VA. Other Government sites may include but are not limited to:

· Naval Air Warfar Center/Aircraft Division (NAWC/AD), Patuxent River, MD

· Edwards AFB, CA

· Naval Air Warfare Center/Weapons Division (NAWC/WD) China Lake, CA

· NAWC/WD, Pt Mugu, CA

· Wright-Patterson AFB, OH

· Eglin AFB, FL

· Outside Continental United States (OCONUS)

Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.3 Meeting Support

In support of the tasking outlined in this PWS, the Contractor shall have the capability to host and conduct meetings at the classification levels up to collateral secret level with the capacity to support a minimum of 20 persons and have contractor furnished telephone and VTC capability as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1). This support shall be provided in proximity (within one mile) of the primary F-35 JPO location in Crystal City, Arlington, VA

3.4 Contract Status Reporting

Specific reports and required deliverables will be included in each individual task order that may be issued under this contract.

3.5 Work Schedule

3.5.1 Work Schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Core hours are 0900-1500, Monday through Friday (except on the legal holidays specified in paragraph 3.5.3). Some supported Government offices have flexibility to start as early as 0500/0530 and end as late as 1900, Monday through Friday. This contract may include non-standard work hours at the task order level, including weekends and/or holidays.

3.5.2 Compressed Work Schedule (CWS): CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other week.

If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the Administrative Contracting Officer’s Representative (ACOR)/Contracting Officer’s Representative (COR). This contract may include tasks or labor categories for which a CWS is not eligible at the task order level.

3.5.3 Holidays: The Government observes the following holidays:

With the exception of the events in section 3.5.1, the Contractor is permitted to observe the above Holidays in accordance with its corporate policy.

3.5.4 Installation Closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without Federal personnel present, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.5.5 Overtime: Overtime as defined in this contract refers to hours worked by a contractor employee in excess of the employee’s normal work week. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements through the use of overtime. Overtime is authorized under this contract to the extent specified in individual task orders, provided COR approval is obtained in advance of each occurrence. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Chief of the Contracting Office.

3.6 Other Direct Costs (ODCs)

3.6.1 Travel: Travel will be allowable only when it is essential to the performance of tasks detailed in each individual task order that may be issued under this contract. Reimbursement for travel performed shall be in accordance with NAVAIR Clause 5252.232-9509 Travel Approval and Reimbursement Procedures. Invoiced travel costs may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking is required. In accordance with NAVAIR Clause 5252.232-9509 Travel Approval and Reimbursement Procedures, travel within a 50-mile driving distance of the Contractor’s regular worksite is considered the Contractor’s official station and therefore not subject to reimbursement. Temporary travel locations may include Continental United States (CONUS) and Outside Continental United States (OCONUS) locations. Travel authorization requests shall be submitted for COR approval 30 days in advance of required travel, when possible, but no less than 15 business days prior to travel.

3.7.1 Material: Purchase of materials shall be in accordance with NAVAIR Clause 5252.242-9515 (Variation) (JUN 2018), Restriction on the Direct Charging of Material. Invoiced material costs may include general and administrative expenses, but shall not include profit. The costs of general purpose business expenses required for the conduct of the Contractor’s normal business operations are not an allowable direct cost in the performance of this contract. General purpose business expenses include, but are not limited to, the cost for items such as telephones and telephone charges, reproduction machines, word processing equipment, personal computers and other office equipment and office supplies. All materials not depleted during the period of performance of each task order shall become Government property upon completion of the associated task order.

3.7 Subcontractors

Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this PWS shall flow down to subcontractors providing support under this contract.

3.8 Management of Contractor Personnel

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.9 Security

3.9.1 Citizenship Requirements:

Only US citizens may perform under this contract, unless waived. If the Contractor cannot find qualified US citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

3.9.2 Investigative Requirements

All Contractor personnel shall maintain a minimum security clearance eligibility of Secret throughout contract performance. Individual task orders may require additional security clearance requirements, depending on the nature of the task to be performed.

All personnel security clearances shall be obtained within 30 days of contract award. Personnel may have an interim clearance at time of contract award unless special accesses are required. Positions designated as Special Access Required (SAR) must have a final Top Secret clearance and be eligible for access under the SAP Nomination Process prior to on-boarding at the F-35 Joint Program Office or associated sites. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated in accordance with DoDM 5220.22, National Industrial Security Program Operating Manual. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The Contractor shall possess and maintain Facility Security Clearance commensurate with the contract DD Form 254, Contract Security Specification for each task order associated with this contract.

3.9.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR)

3.9.3.1 SAAR: All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR) on file, and complete required DoD Annual Information Assurance Training in accordance with NAVAIR Clause 5252.204-9505. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

3.9.3.2 Common Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times above the waist while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department issuing the credential following completion of the contract, relocation or termination of an employee, or upon request from the Contracting Officer’s Representative. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract. Contractor personnel shall comply with all applicable security procedures and regulations for these facilities.

3.9.3.3 DD-254: The Contractor shall comply with security requirements specified in the DD-254 at the task order level of this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; For Official Use Only; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the COR of this contract for approval.

3.9.4 Information Security

If the work is performed at the Contractor’s facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM) and other relevant agency regulations and policies.

3.9.4.1Marking: All information generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDD 5230.24 and program Security Classification Guidance.

3.2.4.2 Public Release: No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate US Government authority.

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the Contracting Officer Representative (COR), Technical Point of Contact (TPOC), and Government Security Office within 24 hours of the incident occurring.

3.9.5 Operational Security (OPSEC)

The Contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The Contractor shall include OPSEC as part of its ongoing security awareness program and take all required activity OPSEC training. The Contractor shall protect identified critical information, controlled unclassified information and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the Requiring Office and contractor in support of the mission

While performing at F-35 JPO sites, the Contractor shall: (1) comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts; (2) include OPSEC as part of its ongoing security awareness program and take all required Agency training; (3) be responsive to the Supporting OPSEC Manager on a non-interference basis; and (4) protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the Requiring Office and contractor in support of the mission.

4.0 STATEMENT OF WORK (SOW) / PERFORMANCE WORK STATEMENT (PWS)

The Contractor shall furnish all of the necessary personnel, materials, services, and facilities incident to the SOW/PWS as stated in each individual task order that may be issued under this contract.

5.0 SERVICES TO BE PROVIDED

5.1 Program Management Support

The contractor shall provide program management support under this contract. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to ensure all F-35 program security support services satisfy the requirements identified in each individual task order that may be issued under this contract.

5.2 Provide General Security Support

· Sub – Task: Provide Administrative Security Support

· Maintain recall rosters, organizational charts, contact cards

· Maintain, update, and coordinate Security Operations Manuals (SOM), Standard Operating Procedures (SOP), Access Management Control Plan (AMCP), Project Security Instruction (PSI), Continuity Of Operations Plan (COOP), Occupant Emergency Plan (OEP), Emergency Action Plan (EAP) and all other Security generated publications

· Schedule and support security meetings

· Coordinate with HR regarding Security Onboarding/Off boarding

· Coordinate onboarding of security new hires

· Coordinate and prepare Security Program Management Review

· Coordinate security conference for International Security

· Primary lead for Task Management Tool

· Maintain and update all Security mail groups and calendar

· Issue Courier cards and provide appropriate courier training

· Monitor, control, and service post office box

· Distribute mail and packages to security offices within Crystal City

· Maintain a central security document and file archive

· Maintain, update, and coordinate all F-35 Security Database Systems (JADE, JPAS, local databases, SharePoint, etc.)

· Maintain and update Security Central Archive

· Provide centralized security customer service support

· Sub – Task: Provide Security Incident Inquiry Support

· Conduct and assist with inquiries impacting the program

· Track and provide data on all reported security incidents

· Provide incident matrix to the GSSO and Director of Security monthly

· Perform classification determinations

· Monitor inquiry progress on incidents impacting the program

· Participate in containment and clean-up actions

· Draft appropriate reports before, during, and after inquiry

· Maintain the Security Incident Guide

· Coordinate with the Information System Security Manager (ISSM)

· Ensure all personnel are notified of the initial incident IAW current policy

· Provide status updates to GSSO

· Sub – Task: Provide Security Education and Training Support

· Collaborate with and develop specific security training for each Special Access Program (SAP)

· Focal point for all JPO security education and training products

· Develop Security Awareness and Training products

· Provide Security Awareness Newsletter to the enterprise

· Provide Commander Call security briefing

· Coordinate with HR regarding new hire orientation

· Develop a Security Education Plan

· Track and provide data on training status for all assigned JPO personnel

· Develop, maintain, track, and conduct comprehensive security training Assist international country security managers with developing country specific security training

· Develop Program Training modules for each supported SAP

· Develop Program Indoctrinations for supported SAPs

· Sub – Task: Provide Operational Security (OPSEC) Support

· Assist in development of OPSEC measures for specific programs

· Aide in the development, management and execution of the JPO OPSEC program

· Sub – Task: Provide Insider Threat Support

· Aide in the development, management, and execution of the JPO Insider Threat Program

· Prepare documentation as required in support of Insider Threat Program

· Sub – Task: Provide Program Protection Support

· Risk Management/Risk Analysis

· Identify Critical Program Information (CPI)

· Identify Mission Critical Functions

· Identify Mission Critical Components

· Develop, manage and execute Program Protection Plans (PPP)

· Develop enhanced protection measures

· Supply Chain Risk Management (SCRM)

· Assist the Government in establishing and chairing an Observables, Identification, and Containment (OI&C) Working Group

· Review PPP and integrate identified changes

· Coordinate and facilitate the review of the F-35 CPIs

· Sub – Task: Provide SAP Security Support

· Manage International Partner/FMS conference space

· Track each Partners/FMS required inventories, self-inspections, training, and other applicable documents

· Maintain and update Cooperative Program Personnel Standard Operating Procedures

· Maintain and update Technology Assessment/Control Plan (TA/CP)

· Coordinate with international country security managers to ensure all requirements are met and properly recorded

· Generate new international security documents as additional FMS participants join the program

· Conduct formal and/or informal inspections at international SAP facilities

· Author detailed trip reports and maintain records of all communications with foreign partners and participants

· Support Government Security Managers at EXCOM and Tri-Service briefings

· Conduct collateral and SAP Security Self-Inspections and Staff Assistance Visits

· Provide support to JPO by arming and disarming secure rooms as needed

· Sub – Task: Provide SCI Security Support

· Sub – Task: Provide Visitor Control Support

· Send and receive all SAP and collateral visit certifications for JPO personnel

· Coordinate permanent certification as appropriate

· Issue, maintain, distribute, track, and inventory all JPO visitor badges

· Process all incoming and outgoing visit requests

· Create and process country clearance requests through the U.S. Governments Foreign Visit System

· Monitor and control incoming and outgoing US Government property

· Collect, maintain, and close out all foreign travel reports

· Sub – Task: Provide Analytical Security Support

· Assess and optimize security processes for a rapidly growing program to ensure consistent security support

· Identify program requirements through review and analysis of user needs

· Analyze and document operational program requirements

· Identify opportunities for improving processes through automation or other means; assist in the preparation of proposals to develop new solutions or processes.

· Sub – Task: Provide Security Escort Support

· Escort and monitor the janitorial, vendor and maintenance personnel working within JPO occupied spaces

· Provide escorts for facility related projects

5.3 Provide Information Security Support

· Sub – Task: Provide Classification Management Support

· Maintain collateral and SAP Security Classification Guides (SCG)

· Develop SCGs

· Develop, manage and execute the classification challenge process

· Coordinate SCG reviews

· Update SCGs as required

· Distribute SCGs as appropriate

· Coordinate SCG changes

· Conduct classification reviews as required

· Review Public Release requests

· Ensure compliance with DoD 5200.01 and 5205.07 volumes

· Sub – Task: Provide Document Control Support

· Perform all document control duties associated with receipt, transmission, inventory, reproduction, disposition, and management of classified information

· Administer receipt and dispatch system for all collateral and SAP information

· Prepare classified packages for transmission through mail, secure fax, or courier

· Maintain document tracking log for Partner/FMS specific AMCP, PSI, SOP, MOU’s, and other applicable documents

5.4 Provide Industrial Security Support

· Sub – Task: Provide Ship & Site Activation Team Security Support

· Brief and coordinate SAP and collateral security requirements for USAF, USN, USMC, and International bed down sites

· Communicate secure facility construction and accreditation technical security standards

· Maintain and monitor security activities at bed down locations until facilities receive accreditation

· Identify security clearance and SAP access requirements at bed down locations

· Assist the services in defining facility and infrastructure requirement to meet F-35 bed down for all sites

· Coordinate and participate in the development of CONUS and OCONUS Facilities Requirements Documents (FRDs)

· Sub- Task: Ensure contractors are compliant with DoD Industrial Security requirements

· Provide and track F-35 JPO contractor compliance

· Sub-Task: Develop DD-254s and coordinate with JPO DD-254 POC

· Draft DD-254’s for prime contractors

· Update and revise existing DD-254’s as changes occur

· Review DD-254’s to ensure accuracy

· Maintain all appropriate supporting documentation for each DD-254

· Validate and maintain a record of each contractor’s facility clearance and storage level

· Validate DD-254 on file for Program Access Requests

· Prepare and coordinate National Interest Determinations (NIDs)

· Provide DD Form 254 guidance and contracting strategies

5.5 Provide Physical Security Support

· Sub- Task: Ensure DoD/ICD compliance

· Maintain and update Occupant Emergency Plan

· Maintain and update Criticality Assessment

· Maintain and update program Evacuation Plan

· Update security portion of programs Continuity of Operations Plan

· Sub-Task: Manage secure area accreditation (construction to decommission)

· Assist with annual facility inspections

· Maintain and track facility accreditation letters

· Complete and maintain Fixed Facility Checklists for each location

· Coordinate with appropriate offices when construction or alterations must be conducted

· Participate in construction meetings

· Document and maintain construction progress and activities

· Sub-Task: Anti-Terrorism Force Protection (ATFP)

· Coordinate and maintain program ATFP Plan

· Manage, track, and provide required ATFP training

· Sub-Task: Alarm Maintenance

· Alarm response and action

· Schedule alarm maintenance as needed

· Coordinate and conduct semi-annual alarm testing

· Sub- Task: Facility access control

· Facility key issuance, inventory, and maintenance

· Security container management

· Monitor, administer, and maintain program badge control system

· Change, issue, and manage combinations on doors and security containers

5.6 Provide Personnel Security Support

· Sub-Task: Personnel Activity Report (PAR) Management

· Electronically update and track all PAR information

· Perform Security Officers review of each PAR

· Schedule and perform SAP indoctrination briefings with approved personnel

· Review and prioritize PARs

· Maintain Personnel files IAW current policy

· Sub-Task: International PAR Management

· Process Partner/FMS PAR’s

· Coordinate and manage program billet rosters

· Sub-Task: Personnel clearance (PCL) management

· Run monthly reports to identify personnel requiring period reinvestigation (PR)

· Notify JPO personnel requiring PR and provide guidance

· Coordinate PR initiation with employee’s Service PERSEC POC

· Sub-Task: Adverse/Required reporting

5.7 Provide Counter-Intelligence Product Support

· Sub – Task: Provide regular updates to adversarial threats to the program

· Work closely with Air Force Office of Special Investigations, Naval Criminal Investigative Service, and Counterintelligence Product Manager to develop and provide periodic threat briefings to program personnel

· Analyze all Intel/CI data and develop security products to support all IPTs

· Sub – Task: Conduct foreign travel briefings

· Develop and maintain foreign threat briefings

· Sub – Task: Provide CI support to the development of P2 Plans

· Sub – Task: Provide CI support to the international and SSAT with current Intel/CI assessments

· Sub – Task: Co-chair and make recommendations to the F-35 CI/Intel Security Working Group and F-35 Security Director

· Sub – Task: Provide A&A/RMF Security Support

· Work in partnership with JPO CIO to ensure program security needs are met in relation to information systems

5.8 Provide Special Security Studies

The contractor shall identify emerging threats and provide technical and analytical expertise to produce special security studies under this contract.

5.5 Provide Foreign Disclosure Support

· Sub – Task: Provide Foreign Disclosure Analysis Support

· Sub – Task: Provide Foreign Disclosure Auditing Support

· Sub – Task: Provide Foreign Disclosure Visit Support

· Sub – Task: Provide Foreign Disclosure Training Support

5.6 Provide Program Protection Cybersecurity Services

· Sub – Task: Provide Security Control Assessor Services: applies to Air Systems (AS), AS Ground Support, Support Equipment Systems, Depot Maintenance, Business, Flight Test, Training Systems – CONUS

· Perform oversight of the development, implementation and evaluation of information system security program policy; special emphasis placed upon integration of existing SAP network infrastructures

· Perform analysis of network security, based upon the Risk Management Framework (RMF) Assessment and Authorization process; advise customer on IT certification and accreditation issues

· Perform risk assessments and make recommendations to customers

· Advise government program managers on security testing methodologies and processes

· Evaluate certification documentation and provide written recommendations for accreditation to Government PMs

· Review system security to accommodate changes to policy or technology

· Evaluate IT threats and vulnerabilities to determine whether additional safeguards are needed

· Advise the government concerning the impact levels for Confidentiality, Integrity, and Availability for the information on a system

· Ensure that certification is accomplished for each information system

· Develop, implement, provide guidance, and enforce AIS security policies and procedures

· Ensure that all ISSOs, network administrators, and other AIS personnel receive the necessary technical and security training to carry out their duties

· Develop, review, endorse, and recommend action by the Authorizing Official (AO) of system assessment documentation

· Ensure approved procedures are in place for clearing, purging, declassifying, and releasing system memory, media, and output

· Conduct certification tests that include verification that the features and assurances required for each protection level fare functional

· Maintain a repository for all system certification/accreditation documentation and modifications

· Coordinate AIS security inspections, tests, and reviews

· Develop policies and procedures for responding to security incidents, and for investigating and reporting security violations and incidents

· Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered within a system

· Ensure that data ownership and responsibilities are established for each AIS, to include accountability, access rights, and special handling requirements

· Ensure development and implementation of an information security education, training, and awareness program, to include attending, monitoring, and presenting local AIS security training

· Ensure that security testing and evaluations are completed and documented

· Evaluate threats and vulnerabilities to ascertain whether additional safeguards are needed

· Assess changes in the system, its environment, and operational needs that could affect the accreditation

· Conduct periodic testing of the security posture of the AIS

· Ensure configuration management (CM) for security-relevant AIS software, hardware, and firmware are properly documented

· At the conclusion of each security assessment activity, prepare the final Security Assessment Report (SAR) containing the results and findings from the assessment

· Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR

· Ensure that system recovery processes are monitored to ensure that security features and procedures are properly restored

· Ensure all AIS security-related documentation is current and accessible to properly authorized individuals

· Ensure that system security requirements are addressed during all phases of the system life cycle

· Coordinate all technical security issues outside of area of expertise or responsibility with System Security Engineering (SSE)

· Provide expert research and analysis in support of expanding programs and area of responsibility

· Participate in routine SCA, Assessment and Authorization Working Group (AAWG), and unscheduled technical discussions/meetings

5.7 Provide Program Protection Cybersecurity (CS) Specialist Services

· Sub – Task: Provide CS Specialist Services for Staff Assistance Visits (SAV) and Support CONUS Operational Assessments (OA) OCONUS/CONUS

· Maintain Cybersecurity SAV and OA Checklists

· Maintain and update database and files for each OA and SAV

· Conduct periodic OA and SAV Cybersecurity assessments

· Provide written account of OA or SAV Cybersecurity assessment to event lead

· Create and maintain knowledge share site/files for OA and SAV lessons learned

· Track OA and SAV findings and resolutions

· Schedule an support OA and SAV meetings

· Provide weekly updates to Enterprise Information System Security Manager (ISSM) and GSSO

· Sub – Task: Provide CS Specialist Services for Technical Security Support Team (TSST): applies to Foreign Military Sales (FMS) sites OCONUS

· Planning, developing, implementing, and maintaining programs, policies, and procedures to protect the integrity and confidentiality of systems, networks, and data.

· Monitor the compliance of FMS participants with ATO requirements for authorized F-35 information systems through on-site visits and email communication.

· Train personnel in cyber positions on cybersecurity best practices, procedures, industry standards, processes, and protocols.

· Develop, administer, and conduct cybersecurity training.

· Coordinate with the FMS Information Systems Security Manager (ISSM) to conduct risk assessments as required on authorized F-35 Information Systems IAW DoD, NSA, DISA, and DTSA regulations and policies.

· Ensure that IA-related components proposed for use in FMS participant F-35 Information Systems comply with NIAP or Common Criteria standards.

· Identify information protection needs for all FMS F-35 programs information systems.

· Interpret and promulgate IS security requirements in accordance with applicable policies and requirements.

· Review Assessment and Authorization (A&A) packages at each step of the RMF/JSIG process and provide feedback addressing deficiencies prior to submittal to JPO Security Control Assessors (SCAs).

· Provide SME input regarding cybersecurity requirements to be included in statements of work and other appropriate procurement documents.

· Ensure that information system(s) design support the incorporation of DoD-directed information assurance vulnerability solutions, e.g., ACAS and SCC.

· Review IS architectures and designs for compliance with the requisite DoD confidentiality, integrity, and availability categorization requirements.

· Assess threats to and vulnerabilities of Japan F-35 program IS.

· Identify, assess, and recommend cybersecurity-enabled products for use within an IS; ensure recommended products are in compliance with the DoD evaluation and validation requirements such as National Information Assurance Partnership (NIAP) and/or Common Criteria.

· Ensure the implementation of security controls properly mitigate identified threats.

· Assess the effectiveness of information protection measures used by the IS.

· Evaluate security architectures and designs and provide input as to the adequacy of security designs and architectures proposed or provided in response to requirements contained in acquisition documents.

· Ensure security deficiencies identified during testing have been mitigated, corrected, or a risk acceptance has been obtained by the appropriate Authorizing Official (AO) or Designated Authorizing Official (DAO).

· Review/monitor A&A process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

· Participate in an IS risk assessment during the A&A process and design security countermeasures to mitigate identified risks.

· Provide engineering support to security/certification test and evaluation activities.

· Review system security design features and provide input to implementation plans and standard operating procedures.

· Identify possible security violations and take appropriate action to report the incidents

5.8 Provide Program Protection Engineering Services

· Sub – Task: Provide Anti-Tamper Security Support

· Sub – Task: Provide COMSEC Engineering Services

· Sub – Task: Provide TEMPEST Engineering Services

6.0 QUALIFICATIONS AND EDUCATIONAL REQUIREMENTS

6.1 Qualifications:

The Contractor shall be responsible for employing personnel with the qualifications and skills required to successfully accomplish the tasking outlined in the PWS. Additionally the contractor shall be responsible for ensuring personnel possess and maintain the appropriate security clearance identified in the individual task orders. Specific labor category definitions will be contained in the individual task orders.

6.2 Experience and Education Level Definitions:

The professional labor category experience and education requirements corresponding to the three levels specified above (i.e., Junior, Journeyman and Senior) are as follows:

JUNIOR: A Junior level person within a labor category generally has less than 3 “years’ experience” performing work related to the labor category functional description and a BA/BS degree (or a qualifying substitution as identified in this section). A Junior level person is responsible for assisting more senior positions and/or performing functional duties under the oversight of more senior positions.

JOURNEYMAN: A Journeyman level person within a labor category has 3 or more years of experience performing work related to the labor category functional description and a BA/BS degree or a qualifying substitution as identified in this section. A Journeyman level person typically performs all functional duties independently.

SENIOR: A Senior level person within a labor category has at least 10 years of experience performing work related to the labor category functional description and a MA/MS degree, or a qualifying substitution as identified in this section. A Senior level person typically works on high-visibility or mission critical aspects of a given program and performs all functional duties independently. A Senior level person may oversee the efforts of less senior staff and/or be responsible for the efforts of all staff assigned to a specific job.

The following qualification substitution chart details the combination of education/experience that can be used as a substitute for the degree requirements applicable to the above experience/education levels, except as noted at the task order level.

Associate’s Degree plus 4 years of additional work experience related to the labor category functional description may be substituted for a Bachelor’s Degree.

All degrees shall be obtained from an “accredited college or university” as recognized by the U.S. Department of Education. This includes Associates, Bachelor’s, Master’s, or Doctorate degrees.

6.3 Key Personnel

This contract may include key personnel at the task order level. For key personnel, there may be specific retention and hiring considerations.

7.0 PERFORMANCE STANDARDS

Performance standards for task orders issued under this contract will be contained in the individual task orders.